Getting Data In

Inherit monitor attributes in input stanzas?

andyk
Path Finder

Is it OK to do like this:

[monitor://E:\Data\pnlog\createsession\]
soucetype = createsession
recursive = false
host = 10.41.10.13
index = main
disabled = 0
followTail = 1
_TCP_ROUTING = pnlogGroup

[monitor://E:\Data\pnlog\endsession\]
soucetype = endsession

[monitor://E:\Data\pnlog\processing\]
soucetype = processing

Will the attributes from the first monitor stanza be inherited by the other monitor stanzas? or do I have to explicitly set the attributes on all monitor stanzas. I will have about 50 monitor stanzas.

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

They are not inherited. You should set each one separately. The only exception is that anything either in a [default] stanza or before any stanza at the beginning of the file will also be inherited by all stanzas. You should be extremely cautious with this latter inheritance, as it occurs even into stanzas that are not in the same file.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

They are not inherited. You should set each one separately. The only exception is that anything either in a [default] stanza or before any stanza at the beginning of the file will also be inherited by all stanzas. You should be extremely cautious with this latter inheritance, as it occurs even into stanzas that are not in the same file.

gkanapathy
Splunk Employee
Splunk Employee

As I said, anything under a [default] stanza is inherited by all stanzas in a file.

0 Karma

leecaf
Explorer

There seems to be some form of inheritance under "Configuration layering for modular inputs" as described here

http://docs.splunk.com/Documentation/Splunk/5.0.2/AdvancedDev/ModInputsSpec

However this only applies across different files. Why does splunk not support the inheritance model as described in the original question?

what is the recommended solution when I have 50 monitor stanzas which share mostly the same config but differ by 1 attribute? should I use the "Configuration layering for modular inputs" mechanism and push the child stanza into the application .conf file?

0 Karma

dwaddle
SplunkTrust
SplunkTrust

You can use Splunk's btool command to see exactly what settings are being pulled into a monitor stanza through default or through other apps.

splunk cmd btool --debug inputs list

http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Usebtooltotroubleshootconfigurati...

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...